Malicious PDF — malware analysis report

Static analysis result for SHA-256 4efc07ca3c50353f…

MALICIOUS

PDF

42.3 KB Created: 2020-09-05 23:42:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6fc29d397a8c968009aefe71d6b0b5f0 SHA-1: 45768452722432eb8d786340249dc52347083d76 SHA-256: 4efc07ca3c50353f59a976e8385bae9f8f1989e42d57daafe850b431d567efaa
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains embedded links that redirect to a known malicious URL, identified by the PDF_MALICIOUS_REDIRECTOR_LINK heuristic. The document body, though heavily obfuscated, contains text related to 'stone masonry construction pdf' and the malicious URL itself, suggesting a lure to a malicious site. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, further supporting the malicious intent.

Heuristics 3

  • PDF links to known malicious redirector infrastructure critical PDF_MALICIOUS_REDIRECTOR_LINK
    PDF contains a clickable URI to redirector infrastructure used by a known malicious PDF SEO/adware delivery campaign. These documents typically rely on user interaction and redirect chains rather than a PDF parser vulnerability.
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://ttraff.club/wix?keyword=stone+masonry+construction+pdf
    • https://static.usrfiles.com/ugd/112488_9b827d83009f400fae7ccf57caf72674.pdf
    • https://static.usrfiles.com/ugd/37428b_907348310ce341819530a167fd97813b.pdf
    • https://static.usrfiles.com/ugd/ffe0d3_24ed8e32c15848f39dfbd5746791de09.pdf
    • https://static.usrfiles.com/ugd/e5cbe5_7ae78837ec7d4433ac45d3acd5c27df8.pdf
    • https://static.usrfiles.com/ugd/2813e2_ac5a04953a16417db742b3eb8e7458a1.pdf
    • https://static.usrfiles.com/ugd/de60da_2c17195ccc924f4fbcd4c560f21226f6.pdf
    • https://static.usrfiles.com/ugd/38eac1_94eca6ccf90540d3b210137ab8b44dc5.pdf
    • https://static.usrfiles.com/ugd/136d3d_8e5cd2d729024744a9228940eacb0372.pdf
    • https://static.usrfiles.com/ugd/b8c837_065e57306a804e498b2f6d58cd73db0c.pdf
    • https://static.usrfiles.com/ugd/e3325f_a2ca8e74cc1f425ba4c119ff94c918fb.pdf
    • https://static.usrfiles.com/ugd/3aca14_1cdf46176b994c968d4b25d348b3a9e5.pdf
    • https://static.usrfiles.com/ugd/912de2_aa821b326acd45568c570ffb38f61ec3.pdf
    • https://static.usrfiles.com/ugd/912de2_2fa6f481006a44999ccf1968ce739d43.pdf
    • https://static.usrfiles.com/ugd/70e5f7_bc71e7931506429ca24fea1ccf53d484.pdf
    • https://static.usrfiles.com/ugd/b1dabf_3b1b2c099c9746ab9f98a3c70467184b.pdf
    • https://static.usrfiles.com/ugd/54bec1_9f10b8b9c90a487db299b45eab10c3c3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066ef.bin
112ae763427d84fee338b2cea72b7d023750dec0cee3d5a1c219cba69c08fa0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66EF 5472 bytes
font_01_sfnt_off00007979.bin
37255634e8023ed8d472d5d123368f103bb88e6b45ce84377993423a01983a22		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7979 9768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.